SkillTestPro | CCNP Security 300-715 SISE Practice Test 12

CCNP Security 300-715 SISE Practice Test 12 (Hard) - Configuring Web Authentication

CISCO CCNP Security Exam Logo

1 / 10

Which Cisco ISE web authentication type redirects a user's browser to a login page hosted centrally on ISE itself, regardless of which network device the user connected through?

TACACS+ device administration, which does not use a browser redirect at all

Centralized web authentication (CWA)

Local web authentication (LWA), which is hosted on the network device rather than centrally on ISE

SGT-based enforcement, which does not use a browser redirect at all

MAC Authentication Bypass, which does not use a browser redirect at all

802.1X with EAP-TLS, which does not use a browser redirect at all

2 / 10

Which Cisco ISE web authentication type hosts the login portal directly on the network access device (such as a switch or wireless controller) rather than centrally on ISE?

Local web authentication (LWA)

Centralized web authentication (CWA), which is hosted centrally on ISE rather than the device

TrustSec SGACL enforcement, which does not use a locally hosted web portal

EAP-TLS certificate-based authentication, which does not use a locally hosted web portal

TACACS+ command authorization, which does not use a locally hosted web portal

PEAP with MSCHAPv2, which does not use a locally hosted web portal

3 / 10

Which redirection mechanism does a network device commonly use to send an unauthenticated user's initial web browsing attempt to the centralized web authentication portal hosted on Cisco ISE?

An SNMP trap sent to the end user's browser directly

A DHCP option instructing the browser to open a spreadsheet application, regardless of the platform version in use

A redirect ACL combined with a RADIUS-supplied redirect URL pointing to the ISE guest/web portal

A static default route configured only on the end user's home router

A TACACS+ command set applied to the end user's personal laptop

A DNS MX record pointing exclusively to an email server

4 / 10

Which Cisco ISE authorization result is typically returned after a device initially fails to complete 802.1X and is instead being directed toward centralized web authentication?

An authorization profile that immediately and permanently blocks the device with no possibility of ever authenticating, under normal operating conditions

An authorization profile that disables all further authentication attempts platform-wide

An authorization profile including a redirect ACL and the CWA redirect URL, granting limited pre-authentication access

An authorization profile granting full, unrestricted administrative network access with no redirect at all

An authorization profile that converts the device's connection to TACACS+ device administration

An authorization profile that automatically enrolls the device as a Cisco ISE administrator account

5 / 10

Which security consideration is important when designing the redirect ACL used for centralized web authentication?

The redirect ACL should permit only the minimal traffic necessary (such as DNS and HTTP/HTTPS to the portal) while still redirecting general web traffic, avoiding overly broad pre-authentication access

The redirect ACL should always be identical to the fully authenticated user's permanent access ACL

The redirect ACL should always permit unrestricted TACACS+ device administration access before authentication

The redirect ACL is irrelevant to security and can be configured with no thought at all

The redirect ACL should always permit completely unrestricted access to the entire internal network before authentication

The redirect ACL should always block DNS entirely, preventing the portal page from ever loading

6 / 10

Which client-side behavior commonly triggers the visible presentation of a captive portal login page during centralized web authentication?

The end user manually editing their computer's system clock

The end user changing their desktop wallpaper image

The end user adjusting their keyboard's language input settings

The end user opening a web browser and attempting to reach any HTTP or HTTPS site, which the redirect ACL and RADIUS redirect URL intercept and route to the portal

The end user restarting their computer with no browser activity at all

The end user plugging in a USB flash drive with no network activity involved, which is inconsistent with expected behavior, in a properly maintained environment, which does not align with best practices

7 / 10

Which troubleshooting step would be appropriate first if users report that they are not being redirected to the centralized web authentication portal at all after connecting to the network?

Immediately disable all authentication policy on the network with no further diagnosis

Assume the issue is caused by the user's choice of desktop wallpaper

Immediately replace every network switch in the building with new hardware

Verify that the redirect ACL and RADIUS authorization result (including the redirect URL) are correctly applied to the session on the network device

Assume the issue is caused by the phase of the moon

Assume the issue is unrelated to ISE and only check the user's home internet service provider

8 / 10

Which use case is well suited to local web authentication (LWA) rather than centralized web authentication (CWA)?

A deployment where TrustSec SGACLs alone are meant to fully replace any web-based authentication

A large multi-site enterprise requiring a single, centrally managed and consistently branded portal experience across all locations

A deployment that requires guest self-registration workflows integrated with ISE's sponsor approval process

A simpler, smaller-scale deployment where hosting the portal directly on a single network device is sufficient and centralized portal management is not required

A deployment that specifically requires ISE to host and manage the portal centrally with no per-device hosting at all

A deployment that has explicitly standardized on centralized portal management for consistency

9 / 10

Which combination of configuration elements must work together correctly for centralized web authentication to function as intended for a wired 802.1X-capable switchport?

Only the switch's spanning tree configuration, with no relationship to ISE policy or redirect ACLs at all, in most deployment scenarios, based on standard platform behavior, based on standard platform behavior, which is not the standard approach

Only the organization's printed employee handbook describing acceptable use policy

Only the end user's browser bookmarks, with no server-side configuration required at all

An appropriate authentication/authorization policy in ISE, a properly configured redirect ACL on the switch, correct RADIUS attributes returned by ISE (including the redirect URL), and DNS/HTTP reachability from the client to the portal

Only the physical Ethernet cable's category rating, with no software configuration involved

Only the guest portal's background image, with no ACL or RADIUS attribute configuration involved

10 / 10

Which combination of web authentication design choices would provide a secure, well-managed guest and BYOD onboarding experience across a large multi-building campus using Cisco ISE?

Web authentication policy configured only in one building while all other buildings have no equivalent policy

No redirect ACL configured at all, relying on users to manually navigate to the portal URL from memory

Local web authentication configured independently and inconsistently on every individual switch across every building, in accordance with common design practices, which is not the standard approach

A single redirect ACL that grants full internal network access before any authentication occurs

Disabling DNS resolution during the pre-authentication phase to simplify configuration

Centralized web authentication with a consistently branded portal hosted on ISE, tightly scoped redirect ACLs, and coordinated authorization policy across all buildings' network devices

Your score is

The average score is 0%